Read the docs
TI-2026-64848 Aliases CVE-2026-100692GHSA-m29q-9cm9-wcf6

Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots

Priority MEDIUM 44CWE-59Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 1 fixed, 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-59 and the CVSS impact.

Summary

Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopped at the mount root itself, so a theme or module checked into themes/ (or a vendored module) could contain a symlink at a mount root (for example themes/mytheme/assets -> /some/dir/outside). Files behind such a symlink were readable during a site build through resources.Get, resources.Match and similar functions, and could be published to public/ via static mounts, bypassing the rule that theme and module mount sources must be local paths. Modules fetched via Go modules are not affected because Go module zips cannot contain symlinks, and this is not an escalation for the main project, which may already mount absolute paths by configuration. Fixed in v0.166.0, where symlinked mount roots and symlinked directories between the mount root and the module directory are treated as non-existent for all modules. As a workaround, inspect themes/ and vendored modules for symlinks at mount roots before building, or replace symlinks with explicit mounts.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00416 36th percentileScored 2026-11-07
Fix Partial hugo (gohugoio): 0.166.0Red Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
gohugoiohugobefore 0.166.00.166.0Patch availableCNA
  • hugo Vendorgohugoio Affected before 0.166.0 Fixed in 0.166.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:gohugo:hugo:*:*:*:*:*:*:*:*0.123.0 to before 0.166.0Vulnerablegohugoio
  • cpe:2.3:a:gohugo:hugo:*:*:*:*:*:*:*:* Versions 0.123.0 to before 0.166.0 Vulnerable ·gohugoio

Remediation

  • Fix · CNA hugo (gohugoio) Fixed in 0.166.0

Red Hat 1 advisory

  • RHSA-2026:66266 Released 2026-09-09 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images hugo-0.166.0-0.1.hum1@aarch64, hugo-0.166.0-0.1.hum1@src, hugo-0.166.0-0.1.hum1@x86_64

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    gohugoio hugo 0.166.0

    5 records Highest priority Priority MEDIUM 2 MEDIUM, 3 LOW

    Other records, highest priority first

    • TI-2026-64846 Hugo v0.161.0 to v0.165.0 Arbitrary File Read via SymlinksPriority MEDIUM 44
    • TI-2026-64849 Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule BypassPriority LOW 38
    • TI-2026-64850 Hugo before 0.166.0 Cross-Site Scripting via text/orgPriority LOW 22
    Show all 5 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Hardened ImagesFixed RHSA-2026:66266
Not affected: 3 products
  • Red Hat Hardened Images
  • Red Hat OpenShift GitOps
  • Red Hat OpenStack Platform 18.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-100692
  2. 2026-10-03 Alias added: GHSA-m29q-9cm9-wcf6

References

Advisory 1

  • TI-2026-64846 Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks CVSS 4.0HIGH 8.7
  • TI-2026-53153 Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant CVSS 4.0CRITICAL 9.3
  • TI-2020-16105 Hugo can execute a binary from the current directory on Windows CVSS 3.1HIGH 8.5
  • TI-2026-64849 Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass CVSS 4.0HIGH 8.6
  • TI-2026-32270 Hugo: Node tool execution allows file system access outside the project directory CVSS 4.0MEDIUM 6.2
  • TI-2026-36906 Hugo: Symlink confinement bypass in resources.Get CVSS 4.0MEDIUM 6.9
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences